From mboxrd@z Thu Jan  1 00:00:00 1970
X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/13649
Path: news.gmane.org!.POSTED.blaine.gmane.org!not-for-mail
From: Markus Wichmann <nullplan@gmx.net>
Newsgroups: gmane.linux.lib.musl.general
Subject: Re: Infinite loop in malloc
Date: Fri, 25 Jan 2019 22:55:22 +0100
Message-ID: <20190125215522.GF23924@voyager>
References: <20190125151350.GB20330@r>
Reply-To: musl@lists.openwall.com
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Injection-Info: blaine.gmane.org; posting-host="blaine.gmane.org:195.159.176.226";
	logging-data="89697"; mail-complaints-to="usenet@blaine.gmane.org"
User-Agent: Mutt/1.10.1 (2018-07-13)
To: musl@lists.openwall.com
Original-X-From: musl-return-13665-gllmg-musl=m.gmane.org@lists.openwall.com Fri Jan 25 22:56:20 2019
Return-path: <musl-return-13665-gllmg-musl=m.gmane.org@lists.openwall.com>
Envelope-to: gllmg-musl@m.gmane.org
Original-Received: from mother.openwall.net ([195.42.179.200])
	by blaine.gmane.org with smtp (Exim 4.89)
	(envelope-from <musl-return-13665-gllmg-musl=m.gmane.org@lists.openwall.com>)
	id 1gn9SV-000NFG-W0
	for gllmg-musl@m.gmane.org; Fri, 25 Jan 2019 22:56:20 +0100
Original-Received: (qmail 20108 invoked by uid 550); 25 Jan 2019 21:56:17 -0000
Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm
Precedence: bulk
List-Post: <mailto:musl@lists.openwall.com>
List-Help: <mailto:musl-help@lists.openwall.com>
List-Unsubscribe: <mailto:musl-unsubscribe@lists.openwall.com>
List-Subscribe: <mailto:musl-subscribe@lists.openwall.com>
List-ID: <musl.lists.openwall.com>
Original-Received: (qmail 20084 invoked from network); 25 Jan 2019 21:56:17 -0000
Content-Disposition: inline
In-Reply-To: <20190125151350.GB20330@r>
X-Provags-ID: V03:K1:/DsuCFYSyH48XskufS1Ns8f1x8sxWzTi7IJWlDWNekbQPzaS1cO
 om0MUjKbUK78RqJeWbiqPw2ACtUEjwHqpks0TCE8+G6yLDbaIUIug0LoPILQ1aQn+ZwfXMd
 HZbZEnsvA4T9rfluA0zjqomEwGRCnN+0t4CxDBOGsbv14Z/ySx1gj0NmGTGiKyamFuTpepb
 RJjvGnGIkMGp+K5I78OXw==
X-UI-Out-Filterresults: notjunk:1;V03:K0:n4OJDkanTIo=:TXSGXxMVsS6szmkMVN0sVs
 CGl3fYqwnd3PZ3W8WLSzRbIJGmTaK+HtLk7MZiTCuHTxMfBNmuLVvlnhR9J3MAewNRPqQIsl6
 fNO3IB4R8hu1uqnx3ZNWAFjkWltE6amuYW25hgm0z5H95aNpscGPxC/jcUOkYLzQvwuYjAH3a
 oKe/qvljrCMX6PvvkhFGHamdHTWAZK2fbC65hpwSCB711x1D2pxaXGS/eq6+3UoHKM3qJEdLG
 BW1mmmCO/+Sc/8PRh8e5P/BPBYOKePdZ7GQNeN4mbDYPmdmYHR1YiFzzKgJg7cFv69Aey8bRb
 UtyFbk9H4mTzEiCOcJzpGgfWMgnNPGBUeCp5HWQwhA0FvAKKBX7zlVd1S/styurZrYBRhYxAa
 sqTnFeR9Vg1Y1beVSX4yf9AbKCJa2BsL+Gi/+dpsc9wAiSu++fqhkODJa9CYJjMt0zq0XCPce
 bvVO5153MHHFPDjLOdAXOcDZ/XVHlVikdHb8QdleY/W9IraB8y/tAJFeyKDdhrNJuJecUjDYf
 X6JzUx5jWdgV6T/CxlLM4mWRRephdqHZ5pHx8LoHUknV6PiAzhUixjdWQfxrdwUeNsA/Jbj5Y
 NzWl9ievge5sJKhTiNH1RmVYfL3pS0gCmDy2FjDLPNbmVSZsAmD7s6B8sWwMztj9JzP6ztxwl
 pIB3scR9BjoSibl3KZQEa3MvNIqLcAVG50JarcJkfnE7ny/0xcVJ2GdHpnsTDsICCYzqmEZha
 IWyd9hRpZjc4S/WlhxaU0capyX6oHiO109ZC8etaGv4lkf4LGcXPnMDfrX2zNl+qtzrPd8PP 
Xref: news.gmane.org gmane.linux.lib.musl.general:13649
Archived-At: <http://permalink.gmane.org/gmane.linux.lib.musl.general/13649>

Hi all,

one more idea I just had: This might be a use-after-free bug. If the
program had clobbered the chunk pointers, the a_and_64() in unbin()
wouldn't be triggered, leading to the infinite loop described in the OP.

Ciao,
Markus